AMENDMENTS TO THE SPECIFICATION 
On page 7, please replace paragraph [0012] as follows: 
[0012] With reference to Figure 1, an example of a computer-based network security 

system 100, in which an embodiment of the present invention can be implemented, is illustrated. 
Network security system 100 collects alerts from various network security devices 112. These 
device devices can include various IDSs 1 12A-C, which can be host or network based, firewalls 
1 12D, routers 1 12E, and various other security devices and products 1 12F. These devices 
generate various alerts that represent physical events and incidents occurring in the network 
being monitored. Each of these devices has access to an internal or external clock that they can 
use to add timestamps to the generated alerts. In one embodiment, distributed agents of the 
network security system 100 collect these alerts. 

On pages 8-9, please replace paragraph [0016] as follows: 
[0016] In some embodiments, a browser-based version of the console 116 may be used to 

provide access to security events, knowledge base articles, reports, notifications and cases. That 
is, the manager 114 may include a web server component accessible via a web browser hosted on 
a personal or handheld computer (which takes the place of console 1 1 6) to provide some or all of 
the functionality of a console 116. Browser access is particularly useful for security 
professionals that are away from the consoles 1 16 and for part-time users. Communication 
between consoles 116 and manager 443 1 14 is bi-directional and may be encrypted. 

On page 16, please replace paragraph [0038] as follows: 
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[0038] In the foregoing description, the various examples and embodiments were meant 

to be illustrative of the present invention and not restrictive in terms of heir their scope. 
Accordingly, the invention should be measured only in terms of the claims, which follow. 
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AMENDMENTS TO THE DRAWINGS 
One replacement sheet has been attached to this document, containing FIG. 2. 
FIG. 2 has been amended. Reference label 206 refers to a box containing text. Within that 
text, "identifmg" has been changed to "identifying." 
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